Open a terminal for your AWS machine from the browser, on Linux and Windows

Sooner or later you need to "get into" the server: restart a service, see why the disk filled up, read a log. And then the usual question comes up: who has the key? A terminal in the browser takes the problem out of the way: nothing has to be installed on the computer of whoever is logging in, no key has to be emailed to them, and there is a record of who logged in. This guide explains what AWS offers you for that in each case and what steps are involved.

Step by step

1. Linux on Lightsail: the web console

   In the Lightsail console, every Linux machine has the Connect using SSH button. A terminal opens in the browser with nothing to configure: Lightsail generates a temporary key, puts it on the machine for a few minutes and logs in as the image's user (bitnami, ubuntu, ec2-user…). It is convenient and secure. What it does not give you: per-person permissions (whoever gets into the AWS console gets into all the machines), a record of who opened what, or a way to give it to an external technician without giving them your AWS account.

2. Linux on EC2: Session Manager

   In EC2 there is no such temporary key. The client-free option is Session Manager, part of Systems Manager: the machine runs an agent (Amazon's images include it) and an IAM role that lets it talk to Systems Manager; from the EC2 console, Connect → Session Manager opens a terminal. Advantages: no need to open port 22 and there is a record. In exchange: the IAM role, the permissions and, if you want to record sessions, an S3 bucket or CloudWatch. It is the route AWS recommends for EC2.

3. Windows: PowerShell over OpenSSH

   The Lightsail console for Windows is Remote Desktop in the browser, heavy and with the Administrator password in the middle of it. The lightweight alternative is the Windows OpenSSH server: in PowerShell as administrator,

   Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
   Set-Service sshd -StartupType Automatic; Start-Service sshd
   New-ItemProperty -Path HKLM:\SOFTWARE\OpenSSH -Name DefaultShell -Value "$env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe" -PropertyType String -Force

   With that, an SSH connection to port 22 opens PowerShell. Open 22 in the Windows firewall and in the Lightsail one only for the IPs that should get in. On Windows Server 2025 the server is already installed and you only have to start it.

4. Check the fingerprint the first time

   The first connection to a machine shows its fingerprint and asks whether you accept it. If you can, compare it with the one the machine itself gives (ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub on Linux; on Windows the same command on C:\ProgramData\ssh\ssh_host_ed25519_key.pub). From then on your client remembers it and warns you if it changes. A changed-fingerprint warning with no reason is serious: do not continue until you understand why.

5. Giving the console to a technician without giving them your account

   Here AWS falls short. The options are to create an IAM user for them with very tightly limited permissions (and maintain them), or to give them an SSH key of their own and copy it to the machines they work on (and remember to remove it). Neither is terrible; both are work that piles up with every technician and every machine, and what usually happens in the end is that "the usual key" gets shared.

What can go wrong